Would you like the 10 second version?
- The body of the regulation says nothing about ‘significant change.’ Just the Q&A header of 32 CFR 170.
- The key regulatory language is actually “Have and maintain for the duration of the contract a current CMMC status...” in 7021. ‘Current’ has a detailed 18 subparagraph definition. The key language in most is “No changes in compliance with the requirements.”
- The DoW CIO FAQ has a nice write-up on ‘significant change.’ This links that concept to ‘continuous compliance’ quite well if read closely.
- Who decides what is a significant change in compliance is not addressed in the regulation, but in the FAQ the DoW points back to the Affirming Official for the organization. They have the responsibility to decide.
- If the Affirming Official decides that a CMMC significant change has affected your compliance with a current certification assessment, then a new certification assessment is required to regain currency as required in the contract language.
The Long Version
A recent discussion about the Cybersecurity Maturity Model Certification (CMMC) again raised the question: “What constitutes a ‘significant change’ that requires a new CMMC assessment?” This has been debated since the language appeared in 32 CFR 170 two years ago. For a defense contractor in the Defense Industrial Base, the answer decides whether a new assessment stands between you and Department of Defense (DoD) contracts. I have generally taken the position that the threshold should be fairly high. Information systems change constantly. Hardware gets replaced. Employees come and go. Software is upgraded. Security products change. Networks are reconfigured. System Security Plans (SSPs) are updated to reflect those changes.
One position I recently encountered was that essentially any change requiring a change to the SSP should be considered a significant change. As someone who implements these programs, that struck me as unworkable. An SSP is supposed to accurately describe the system. If updating the SSP can invalidate the assessment of that system, organizations have a strong incentive not to maintain their SSPs accurately.
That sent me back to the regulations to dig in and really define what the regulations actually say, rather than what myth, legend, and thought leadership proclaim. What I found was very interesting, and again my thinking on the subject matured from further study.
What Does 32 CFR Part 170 Actually Say?
The logical place to start is 32 CFR 170, the CMMC Rule. 32 CFR § 170.19, CMMC Scoping, establishes the requirements for defining the CMMC Assessment Scope. For Level 2, it identifies asset categories and establishes how assets are treated for scoping, documentation, and assessment purposes. Level 2 applies to a contractor that handles Controlled Unclassified Information (CUI) and must implement the security requirements in NIST SP 800-171, while Level 1 covers a contractor that handles only Federal Contract Information (FCI), with the contract specifying which level applies.
What § 170.19 does not appear to contain is a codified requirement stating that a “significant change” automatically requires a new CMMC assessment. Nor does Part 170 define “significant change” as a regulatory term establishing a bright-line reassessment threshold.
So where did the significant-change language come from?
The Language Is in the Rule Supplementary Information
The language appears in the preamble and responses to public comments accompanying the 32 CFR Part 170 final rule. In one response, DoD stated:
“Self-assessments and certification assessments are valid for a defined CMMC Assessment Scope as outlined in § 170.19 CMMC Scoping. A new assessment is required if there are significant architectural or boundary changes to the previous CMMC Assessment Scope.”
DoD then gave examples: expansions of networks and mergers and acquisitions. Just as importantly, DoD distinguished those changes from ordinary operational changes. It explained that adding or subtracting resources within the existing assessment boundary, when those resources follow the existing SSP, does not require a new assessment and instead can be addressed through annual affirmation of continuing compliance.
Elsewhere in the same final-rule Supplementary Information, DoD used somewhat softer language, stating that a new CMMC assessment “may be required” if significant architectural or boundary changes are made to the previous Assessment Scope.
That difference between “is required” and “may be required” is huge. More fundamentally, however, this significant-change discussion appears in the explanatory material accompanying the rule, not as a defined trigger in the operative text of § 170.19. The preamble is important evidence of how DoD understands the rule it wrote. It should not be ignored. But that does not have the same force of law and regulation as actually being contained in the regulation itself. Legally it has a very different status. Guidelines, not rules.
The CMMC Scoping Guide Repeats the Concept
The CMMC Level 2 Scoping Guide repeats almost word for word the same language contained in the regulation discussion. It says that a new assessment is required if there are significant architectural or boundary changes to the previous CMMC Assessment Scope, again giving network expansions and mergers and acquisitions as examples. It likewise distinguishes operational changes within an existing boundary.
The Scoping Guide is useful interpretive guidance, but it is guidance. The document itself explains that its contents do not have the force and effect of law and are intended to provide clarity concerning existing requirements. That distinction matters when people attempt to turn “significant change” into an automatic, bright-line recertification rule. Again, guidelines, not rules.
Now Look at DFARS 252.204-7021
In general, this argument has been conducted based on the 32 CFR 170 CMMC Rule. The DFARS rule, however, which adds CMMC requirements into contracts, offers other language. DFARS 252.204-7021 defines when a CMMC Status is “Current.” For Final Level 2 (Self) and Final Level 2 (C3PAO), the status generally must be no older than three years and must have:
“No changes in compliance with the requirements at 32 CFR part 170 since the Final CMMC Status date.” (emphasis added)
The “changes in compliance” language leads to a logical conclusion that as long as compliance is maintained the related assessment or certification remains “current.” The clause also requires the corresponding affirmation of continuous compliance in the Supplier Performance Risk System (SPRS). Notice what the definition does not say. It does not say “no changes to the SSP.” It does not say “no changes to the information system.” It does not even use “no significant changes” as the test. It says: no changes in compliance with the requirements at 32 CFR Part 170.
‘Significant Change’ Is Not the Same as a ‘Change in Compliance’
A change might be subjectively considered significant, and not be a change in compliance. Every functioning information system changes. Imagine that a company successfully completes a Level 2 C3PAO assessment. Six months later it replaces 20 aging laptops with new laptops configured to the same security baseline. The system changed. The asset inventory should change. The SSP or network diagram might require an update. None of that necessarily means the organization experienced a change in compliance with 32 CFR Part 170.
Consider other routine examples:
- Replacing a firewall with a newer model providing the same required security capabilities.
- Adding employees and properly configured endpoints inside the existing boundary.
- Replacing one EDR product with another while maintaining the required security functions.
- Adding or retiring servers within the existing assessed environment.
- Changing vulnerability-scanning products.
- Changing an MSP while maintaining a compliant architecture and properly addressing the resulting scoping and responsibility changes.
- Updating the SSP to more accurately describe how a security requirement is implemented.
Some of those changes could become significant depending on the facts. None of them, standing alone, necessarily establishes that the organization is no longer compliant or that the CMMC Assessment Scope has been fundamentally altered.
“Any SSP Change” Is the Wrong Test
All of this together makes it pretty clear that “any change to the SSP” is not the test we should be using. The SSP is supposed to describe the system. A good SSP is a living document. If I replace a security product, modify an authentication architecture, add a server, change a service provider, or otherwise alter how a requirement is implemented, I may need to update the SSP. That is good configuration management and good compliance practice.
Making an SSP revision itself the trigger for reassessment also creates a perverse incentive: keep the SSP unchanged so you do not jeopardize the certification. That result is difficult to reconcile with DoD’s express recognition that operational changes can occur within an assessed environment without requiring a new assessment.
The DoW CIO CMMC FAQ
Leaving the regulations, I moved over to the DoW CIO CMMC FAQ page. A Frequently Asked Questions (FAQ) web page does not constitute authoritative regulation. It can inform interpretation of existing regulations. Nevertheless, in the broader government and cyber community context many people view the FAQ as authoritative as the regulation itself. The truth is, again, guidelines, not rules. The CMMC FAQ C-Q12 does offer a very well-written set of considerations around ‘significant change’ determinations, however. Critically it says:
“The decision of whether a change is significant enough to require a reassessment is the responsibility of the Affirming Official, who bears the legal and contractual risk of continued compliance and may benefit from consultation with authorized independent consultants.”
This moves the consideration from whether or not a change is significant, to whether or not the change impacted the compliance of the system. Compliance is the key regulatory requirement, and it falls back on the 7021 definition of ‘current,’ not the 32 CFR 170 non-regulatory discussion of what is significant.
The Better Question Is “Is My System Still Current?”
Really, from a defense company perspective, what leaders want to know is: when do I have to pay for another C3PAO certification? That is where the rubber meets the road for business owners. Cybersecurity personnel in government and industry may wince at that, but this is what business owners must consider. As a small business owner for the last six years, I have learned a lot about this reality, and it is not just about greedily lining my pockets that many who have not lived that reality presume. It is about keeping my business afloat, paying my bills, and most importantly paying my people. Business owners must be focused on the bottom line or pretty soon they do not have a business.
This deep dive has changed my position on recertification assessments. If the AO decides that the change has impacted compliance, then a new certification assessment is required. By basing this argument on ‘current’ rather than ‘significant,’ though, it is not the size or impact of a change that matters. It is whether or not that change puts you out of compliance. By planning carefully, I would think that most changes, even pretty large ones, can be executed without impacting your compliance with the controls or weakening your security posture.
The bottom line is the Affirming Official must decide whether or not a change was significant enough to impact the compliance of the system. They should make that decision in light of the guidance documents that we have on this, including the regulatory Q&A and the FAQ. If it does, then we must review what current CMMC Levels are required in our contracts. If this is self-assessment only, then a new self-assessment is sufficient. If it is a certification assessment, then a new certification assessment is required.
Sources
- 32 CFR Part 170, including § 170.19 (CMMC Scoping)
- CMMC Program Final Rule, 89 Fed. Reg. 83092 (Oct. 15, 2024), including discussion of significant architectural or boundary changes
- DFARS 252.204-7021, Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements
- DFARS 252.204-7025, Notice of Cybersecurity Maturity Model Certification Level Requirements
- DoD CMMC Level 2 Scoping Guide
Note: This article reflects the author’s interpretation of the CMMC regulations and related guidance and is intended for discussion and informational purposes. Organizations should evaluate changes based on their specific architecture, assessment scope, contractual requirements, and circumstances.
